Channel, Networking

Cyber Resilience Provides MSPs With A Competitive Edge


Today’s businesses would be hard-pressed to survive and thrive without embracing open standards and tools like email, remote collaboration solutions, and cloud-based SaaS technologies. These have been especially useful to small and medium-sized businesses (SMBs), allowing even the smallest companies to compete with much larger players and scale to meet global demand. Yet these same technologies have also created more vulnerabilities than ever before.

To reduce the impact of today’s cyberthreats, SMBs — and the managed service providers (MSPs) they depend on — need concrete cyber resilience strategies.

Cyberthreats are more dominant — and dangerous — than ever before

Ransomware may dominate the headlines, but it isn’t the only cyber risk out there. Malware that can shut down operations or cause dangerous critical failures, Denial-of-Service (DoS) attacks which can render products and services entirely non-functional or inaccessible, and data breaches that steal confidential information (worth far more than a ransom payout) are just three more types of threats that are becoming increasingly commonplace.

The situation is especially risky for smaller businesses. According to the U.S. Small Business Administration, “88% of small business owners felt their business was vulnerable to a cyberattack.” However, these are the same organizations that typically lack an in-house cybersecurity team, a security-focused MSP, or both.

The FBI’s Internet Crime Complaint Center reports 791,790 complaints of cyberattacks in 2020, leading to $13.3B in losses in the U.S. alone. Attacks reported include phishing, extortion, data breaches, and identity theft. There has also been a rise in automation to create more powerful and sophisticated attacks — including credential stuffing, DoS, and exploit kits — allowing anyone to establish their own cybercrime business.

Security has become a significant concern over the last few years due to a few additional factors:

  • COVID “Cyber pandemic” — chaos, confusion, weakened infrastructure and management chain (and also turning medical and pharma companies into major targets)
  • Price decreases for AI and bot tools, making these more available to attackers
  • The rise of nation-state actors, mainly the “big four”: China, Russia, North Korea, and Iran

Cyber resilience: How to weather any storm

From smaller organizations having their hard drives wiped and data held for ransom, to major industrial operations having production lines hijacked, helping your clients survive in this threat environment means being able to predict, withstand, and adapt to challenges.

Effective cybersecurity starts with an assumption of breach: you must operate under the notion that however good your protection may be, a data breach is inevitable. Cyber resilience is a measure of your ability to prepare for, respond to, and recover from such breaches, as well as other adverse events like natural disasters and equipment failures.

The following strategies will help grow your clients’ resilience, ensuring that you can pivot optimally and assist in recovery from any type of adverse event.

Understand unique client requirements

Sometimes it helps to define “never events” — a term from the world of medicine that refers to events of such severity that they can never be allowed to happen. For example, it’s too easy to promise “zero downtime” without the actual ability or a plan in place to make that happen, and without buy-in from client stakeholders across their entire organization.

That process isn’t simple, but there are a few steps that can make it simpler:

  • Assess the types and severity of risks your client is most likely to face
  • Ensure that you have surveyed their entire organization and documented key processes
  • Conduct a risk assessment to determine vulnerabilities
  • Document current procedures
  • Begin moving toward disaster recovery planning and testing (more on this below)

Balance protection and security

To achieve the right balance of protection and security, you’ll need to assess and deploy appropriate tools that prioritize your clients’ business-critical data, systems, and applications:

  • Plan and test backups regularly 
  • Protect backups, for instance, by conducting backup scans and air-gapping against malware
  • Utilize a security platform with a broad range of cyber protection features to minimize configuration and maintenance demands
  • Create a comprehensive patching program that covers all clients’ operating systems and endpoints
  • Make use of immutable storage for essential data retention

Adapt to the new normal

Cybercrime isn’t the only thing that’s changed over the last few years. The “new normal” for IT is more complicated than ever, with businesses relying on work-from-home practices, massively distributed workforces, bring-your-own-device (BYOD) policies, and the Internet of Things (IoT).

This scenario creates a broad range of new potential attack surfaces and methods that traditional security techniques can’t address. A classic virus scanner or firewall, for instance, won’t do much good if the attacked device is outside your client’s local network.

  • Ensure that you have a comprehensive understanding of your client’s entire business 
  • Develop a strategy to minimize the risk of lateral attacks from within their network and protect all endpoints 
  • Limit access to confidential or sensitive data by implementing a zero-trust approach
  • Guide your clients’ corporate culture of secure data access and transmission as well as driving risk awareness (along with an understanding of the strategic importance of cyber resilience to their business)

Leverage the cloud

The cloud has been extremely good to SMBs. It offers powerful business applications that scale up or down as they need, saving on capital expenditures and letting them control costs as they grow. But it’s also a source of some of their greatest vulnerabilities.

Most organizations assume SaaS providers will handle security when they migrate their activities to the cloud. This migration makes SMBs’ IT environments more complex, resulting in increased risk to themselves and to their service providers in turn.

  • Raise client awareness about the risks associated with typical SaaS applications — especially email tools — stemming from a rise in social engineering and phishing attacks
  • Provide multi-factor authentication for all SaaS applications that don’t do so automatically

Prepare for disaster

No one wants to think about disaster situations. But while both data protection and cybersecurity are essential practices, neither entirely addresses the question of what to do when the worst does happen.

Obviously, your clients hope they will never need you for disaster recovery. But they need to

view these capabilities as their “IT insurance policy” to keep their employees, customers, and reputation safe should disaster strike.

  • Deliver on the risk analysis and other business priorities identified above, including evaluating costs versus risks to create crystal-clear prioritization
  • Consider offline backups or disaster recovery solutions that are inaccessible to cyberattacks
  • Create an incident response plan
  • Establish a hierarchy and clear roles to ensure a cohesive, orderly approach to recovery
  • Include a plan to reassess cyber resilience, share lessons learned, and implement changes
  • Test incident plans regularly, making testing exercises as realistic as possible

MSPs are rising to meet the unique challenges their clients face. Theoretically, a managed services provider could level the playing field, allowing resource-constrained SMBs to outsource some or all of their IT management and security needs. Unfortunately, there is a gap in the differences between these two services, and not all MSPs are created equal. Many MSPs also offer similar services, making differentiation difficult. 

MSPs who hope to achieve success in the market need to offer a broader range of services and demonstrate their expertise in the critical area of cyber resilience. For more information on how to create a comprehensive cyber resilience program, grab your free copy of Acronis’ e-book, Cyber resilience: Uncovering strategies and technologies.

This guest blog is courtesy of Acronis. Read more Acronis guest blogs hereRegularly contributed guest blogs are part of ChannelE2E’s sponsorship program.